CVE-2026-86099: Chainlit path traversal

CISO Take

Chainlit, a framework used to build chat interfaces for LLM and RAG applications, fails to validate the client-supplied socket.io sessionId parameter, letting an unauthenticated attacker inject path traversal sequences that escape the upload directory and recursively delete arbitrary directories accessible to the service process. This matters because the attack requires no authentication, no user interaction, and low complexity (CVSS 8.2, AV:N/AC:L/PR:N/UI:N), meaning any internet-facing Chainlit deployment is a one-shot target for a destructive availability attack against the chat application, its stored files, and any co-located data the process account can write to. There is no CISA KEV listing, no public exploit or Nuclei template, and no EPSS score yet, but the trivial exploitability and Chainlit's popularity as a front-end for RAG and agent apps make this a priority patch rather than a wait-and-see item. Upgrade past 2.12.0 to a fixed release as soon as one is available, and in the interim isolate the upload/session directory (containerized filesystem, chroot, or dedicated low-privilege service account) so a traversal payload cannot reach directories outside the sandbox. Monitor socket.io connection logs for sessionId values containing '../', '..\', or absolute path prefixes as a detection signal.

Sources: NVD GitHub Advisory vulncheck.com ATLAS

What is the risk?

High severity (CVSS 8.2) driven by network-reachable, unauthenticated, low-complexity exploitation (AV:N/AC:L/PR:N/UI:N) with a high availability impact (A:H) via recursive directory deletion, offset by low integrity impact and no confidentiality impact. No active exploitation signals exist (not in CISA KEV, no EPSS score, no public PoC or Nuclei template found), so this is currently a disclosed-but-unweaponized vulnerability. Given the low bar to craft a malicious sessionId and the lack of required authentication, the realistic time-to-exploit is short once technical details circulate, so treat this as urgent-but-not-yet-emergent.

How does the attack unfold?

Initial Access

The attacker connects without authentication to the public-facing Chainlit application's socket.io endpoint.

AML.T0049

Exploitation

The attacker submits a crafted sessionId parameter containing absolute or relative path traversal sequences that the server fails to validate.

Impact

The service recursively deletes directories outside the intended upload path, destroying application data and denying service to legitimate users.

AML.T0029

Initial Access

The attacker connects without authentication to the public-facing Chainlit application's socket.io endpoint.

AML.T0049

Exploitation

The attacker submits a crafted sessionId parameter containing absolute or relative path traversal sequences that the server fails to validate.

Impact

The service recursively deletes directories outside the intended upload path, destroying application data and denying service to legitimate users.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Chainlit	pip	—	No patch
12.4K 41 dependents Pushed 10d ago 50% patched ~45d to patch Full package profile →

Do you use Chainlit? You're affected.

How severe is it?

CVSS 3.1

8.2 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 33% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I Low

A High

What should I do?

1 step

Upgrade Chainlit to a patched release above 2.12.0 as soon as the vendor publishes one (track the GitHub repo and the VulnCheck advisory for the fix version). Until patched, run Chainlit under a dedicated low-privilege OS/service account with write access restricted solely to its intended upload/session directory (container volume isolation or chroot is effective). Add input validation or a reverse-proxy/WAF rule that rejects socket.io connection parameters containing '../', '..\', or leading '/' sequences. Enable and review access/application logs for anomalous sessionId values and unexpected filesystem deletions, and ensure backups of any Chainlit-managed data exist outside the reachable filesystem scope.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoS Auth Bypass Framework AML.T0029 - Denial of AI Service AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

Annex A.6.2 - Security of AI system components

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

Frequently Asked Questions

What is CVE-2026-86099?

Chainlit, a framework used to build chat interfaces for LLM and RAG applications, fails to validate the client-supplied socket.io sessionId parameter, letting an unauthenticated attacker inject path traversal sequences that escape the upload directory and recursively delete arbitrary directories accessible to the service process. This matters because the attack requires no authentication, no user interaction, and low complexity (CVSS 8.2, AV:N/AC:L/PR:N/UI:N), meaning any internet-facing Chainlit deployment is a one-shot target for a destructive availability attack against the chat application, its stored files, and any co-located data the process account can write to. There is no CISA KEV listing, no public exploit or Nuclei template, and no EPSS score yet, but the trivial exploitability and Chainlit's popularity as a front-end for RAG and agent apps make this a priority patch rather than a wait-and-see item. Upgrade past 2.12.0 to a fixed release as soon as one is available, and in the interim isolate the upload/session directory (containerized filesystem, chroot, or dedicated low-privilege service account) so a traversal payload cannot reach directories outside the sandbox. Monitor socket.io connection logs for sessionId values containing '../', '..\', or absolute path prefixes as a detection signal.

Is CVE-2026-86099 actively exploited?

No confirmed active exploitation of CVE-2026-86099 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-86099?

Upgrade Chainlit to a patched release above 2.12.0 as soon as the vendor publishes one (track the GitHub repo and the VulnCheck advisory for the fix version). Until patched, run Chainlit under a dedicated low-privilege OS/service account with write access restricted solely to its intended upload/session directory (container volume isolation or chroot is effective). Add input validation or a reverse-proxy/WAF rule that rejects socket.io connection parameters containing '../', '..\', or leading '/' sequences. Enable and review access/application logs for anomalous sessionId values and unexpected filesystem deletions, and ensure backups of any Chainlit-managed data exist outside the reachable filesystem scope.

What systems are affected by CVE-2026-86099?

This vulnerability affects the following AI/ML architecture patterns: AI chat UI / conversational interfaces, RAG pipelines with Chainlit front-ends, Agent frameworks exposing a Chainlit UI, LLM application deployments using Chainlit for user interaction.

What is the CVSS score for CVE-2026-86099?

CVE-2026-86099 has a CVSS v3.1 base score of 8.2 (HIGH). The EPSS exploitation probability is 0.39%.

What is the AI security impact?

Affected AI Architectures

AI chat UI / conversational interfacesRAG pipelines with Chainlit front-endsAgent frameworks exposing a Chainlit UILLM application deployments using Chainlit for user interaction

MITRE ATLAS Techniques

AML.T0029 Denial of AI Service

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Annex A.6.2

NIST AI RMF: MEASURE 2.7

What are the technical details?

Original Advisory

Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse filesystem paths by injecting absolute or relative path sequences. Attackers can craft malicious sessionId values that escape the upload directory and recursively delete arbitrary directories accessible to the service process.

Exploitation Scenario

An attacker identifies a public-facing Chainlit deployment (common for internal or customer-facing LLM chat/RAG demos) and opens a socket.io connection without needing any credentials. They craft a sessionId value containing path traversal sequences (e.g., relative '../../' chains or an absolute path) instead of a normal session identifier. The vulnerable session-handling code uses this value directly to construct filesystem paths, causing the service to recursively delete directories outside the intended per-session upload folder — wiping application data, other users' uploaded files, or unrelated directories owned by the same process account, resulting in a denial of service for the AI application.

Weaknesses (CWE)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.